fix: 外部审查 8 项修复 + 国密 TLS 按需回退

- UserAgent 默认值回退 + 注册 -ua flag (#2)
- README 编译命令 main.go → . (#3)
- README 版本号同步 rc.1 (#4)
- Client.go gmtls stdout 劫持删除 (#5)
- ms17010 smb1GetResponse size<32 越界 panic (#6)
- SSH 拨号超时统一 ModuleTimeout (#8)
- AddPorts 死字段删除 (#9)
- 国密 TLS 按需回退：标准 TLS 握手失败时仅在错误为
  cipher/protocol 不兼容时尝试国密，跳过超时/拒绝等连接级错误

webscan/lib/Client.go

@@ -11,7 +11,6 @@ import (
 	"os"
 	"strconv"
 	"strings"
-	"sync"
 	"time"
 
 	"github.com/shadow1ng/fscan/common"
@@ -32,8 +31,6 @@ const (
 	ProxySocks5URL = "socks5://127.0.0.1:1080"
 )
 
-var gmtlsStdoutMu sync.Mutex
-
 // 全局HTTP客户端变量
 var (
 	Client             *http.Client      // 标准HTTP客户端
@@ -205,20 +202,10 @@ func InitHTTPClient(ThreadsNum int, DownProxy string, Timeout time.Duration, max
 				Timeout:   dialTimeout,
 				KeepAlive: keepAlive,
 			}
-			// 抑制 gmtls 库的 fmt.Println("handshake error") 噪声
-			gmtlsStdoutMu.Lock()
-			orig := os.Stdout
-			if devNull, err := os.OpenFile(os.DevNull, os.O_WRONLY, 0); err == nil {
-				os.Stdout = devNull
-				defer devNull.Close()
-			}
-			conn, err := gmtls.DialWithDialer(dialer, network, addr, &gmtls.Config{
+			return gmtls.DialWithDialer(dialer, network, addr, &gmtls.Config{
 				GMSupport:          gmtls.NewGMSupport(),
 				InsecureSkipVerify: true,
 			})
-			os.Stdout = orig
-			gmtlsStdoutMu.Unlock()
-			return conn, err
 		},
 		MaxConnsPerHost:     20,
 		MaxIdleConns:        20,

webscan/lib/Eval.go

@@ -508,8 +508,9 @@ func DoRequest(req *http.Request, redirect bool, session *common.ScanSession) (*
 		oResp, err = requestClient(false).Do(req)
 	}
 
-	// 标准TLS连接失败时，尝试国密TLS客户端
-	if err != nil && req.URL.Scheme == "https" {
+	// 标准TLS握手级别失败时，尝试国密TLS客户端
+	// 跳过连接超时、拒绝等非 TLS 相关错误，避免无意义的国密握手尝试
+	if err != nil && req.URL.Scheme == "https" && maybeGMTLSError(err) {
 		if req.GetBody != nil {
 			if body, bodyErr := req.GetBody(); bodyErr == nil {
 				req.Body = body
@@ -682,3 +683,14 @@ func getRespBody(oResp *http.Response) ([]byte, error) {
 
 	return body, nil
 }
+
+func maybeGMTLSError(err error) bool {
+	if err == nil {
+		return false
+	}
+	s := err.Error()
+	return strings.Contains(s, "handshake failure") ||
+		strings.Contains(s, "protocol version") ||
+		strings.Contains(s, "no mutual") ||
+		strings.Contains(s, "cipher suite")
+}

webscan/lib/eval_test.go

@@ -1238,7 +1238,7 @@ func TestDoRequestSkipsNilGMTLSFallback(t *testing.T) {
 	}()
 
 	ClientNoRedirect = &http.Client{Transport: roundTripFunc(func(*http.Request) (*http.Response, error) {
-		return nil, errors.New("standard tls failed")
+		return nil, errors.New("tls: handshake failure")
 	})}
 	ClientNoRedirectGM = nil
 
@@ -1261,7 +1261,7 @@ func TestDoRequestReplaysBodyForGMTLSFallback(t *testing.T) {
 
 	ClientNoRedirect = &http.Client{Transport: roundTripFunc(func(req *http.Request) (*http.Response, error) {
 		_, _ = io.ReadAll(req.Body)
-		return nil, errors.New("standard tls failed")
+		return nil, errors.New("tls: handshake failure")
 	})}
 
 	var gotBody string